Standalone WorkloadIdentityClient

[duffenterprises]

TL;DR

Is it possible to use the WorkloadIdentityClient in a standalone manner? I have an OIDC compliant provider and would like to instruct teams to act with our onpremise OIDC provider like we do with github.

The existing documentation suggests dropping down to gcloud to create the credentials but it seems like this breaks the spirit of the implementation.

Detailed design

No response

Additional information

No response

[github-actions]

Hi there @duffenterprises 👋!

Thank you for opening an issue. Our team will triage this as soon as we can. Please take a moment to review the troubleshooting steps which lists common error messages and their resolution steps.

[sethvargo]

Hi @duffenterprises

Thank you for opening an issue. We do not intend to support the WorkloadIdentityClient as a standalone package. It's specific to this GitHub Action. Since this is open source, I would recommend you fork or incorporate it into your project while maintaining the copyright.

Those gcloud commands just write out a JSON file that points to an envvar or file to get the OIDC token. You can set GOOGLE_APPLICATION_CREDENTIALS to point to that file.

[duffenterprises]

@sethvargo Perhaps this is better asked to the team that maintains this documentation, but why is this the prescribed path?

[sethvargo]

@duffenterprises - I would recommend opening an issue on that repo and tagging @bcoe. He's done a lot of work in the space on that repo.

but why is this the prescribed path?

Can you clarify what you mean by "this"?